Secure Element Key Generation with One-Time Programmable Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for securing cryptographic keys are vulnerable to attacks like Differential Fault Analysis, which can compromise the global private key, leading to a single point of failure in security systems.
Innovation Solution
A device with a secure element connected to a one-time-programmable memory generates a unique device-specific asymmetric key pair using a global value, stores it irreversibly, and signs the public key, erasing the global private key to prevent tampering and reuse, thereby enhancing security by limiting the global private key's exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a global key pair is used for authentication across multiple trusted devices, then authentication efficiency is improved, but security is worsened due to single point of failure vulnerability
Solution Approach 1:
The patent segments the global authentication system into device-specific key pairs, where each trusted device generates its own unique private key and public key. This segmentation eliminates the single point of failure while maintaining authentication efficiency through decentralized key management.
Solution Approach 2:
Each trusted device is assigned local quality through device-specific cryptographic keys stored in secure elements. The private key remains localized to each device's secure element, providing tailored security protection for each device while enabling global authentication through public key distribution.
2Ease of operation
If the global private key is stored in accessible memory, then key generation and usage is simplified, but vulnerability to attacks like Differential Fault Analysis increases
Solution Approach 1:
The patent extracts the private key from general-purpose memory and places it exclusively in a secure element with restricted access. The private key is taken out of the vulnerable memory environment and isolated in a protected cryptographic module, eliminating exposure to Differential Fault Analysis and other memory-based attacks.
Solution Approach 2:
The secure element acts as an intermediary between the private key and the external world. It mediates all cryptographic operations, allowing the private key to remain isolated while still enabling authentication functions through controlled interaction with public keys and cryptographic algorithms.
3Reliability
If invasive attacks like laser fault injection are possible, then device security is compromised, but preventing such attacks requires complex protective measures
Solution Approach 1:
The patent implements preliminary action by designing the secure element with inherent protection against fault injection attacks before they can occur. The cryptographic operations are performed within a hardened environment that preemptively prevents laser fault injection and other invasive attacks, avoiding the need for complex runtime detection and response systems.
Data Source
AI summary
A method to protect a device key in a device comprising at least one secure element locally connected to at least one time programmable memory storing a global value in form of a bit string comprising locked bits and unlocked bits. The locked bits are irreversibly pre-programmed in the one-time-programmable memory during an initialization phase of the device while the un-locked bits remaining in an initial state may be programmable by the secure element. The secure element is configured to generate, at initialization of the device, a device specific value by using the global value, program the device specific value previously obtained in the one time programmable memory, and erase the global value by programming the unlocked bits of the corresponding bit string. A further object of the disclosure includes a device configured to carry out the method.